linker_environ.cpp revision 4df577fef74063507cba229bce352bbcf89df279
1/* 2 * Copyright (C) 2010 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29#include "linker_environ.h" 30 31#include <linux/auxvec.h> 32#include <stddef.h> 33#include <stdlib.h> 34#include <unistd.h> 35 36static char** _envp; 37static bool _AT_SECURE_value = true; 38 39bool get_AT_SECURE() { 40 return _AT_SECURE_value; 41} 42 43static void __init_AT_SECURE(unsigned* auxv) { 44 // Check auxv for AT_SECURE first to see if program is setuid, setgid, 45 // has file caps, or caused a SELinux/AppArmor domain transition. 46 for (unsigned* v = auxv; v[0]; v += 2) { 47 if (v[0] == AT_SECURE) { 48 // Kernel told us whether to enable secure mode. 49 _AT_SECURE_value = v[1]; 50 return; 51 } 52 } 53 54 // We don't support ancient kernels. 55 const char* msg = "FATAL: kernel did not supply AT_SECURE\n"; 56 write(2, msg, strlen(msg)); 57 exit(EXIT_FAILURE); 58} 59 60// Check if the environment variable definition at 'envstr' 61// starts with '<name>=', and if so return the address of the 62// first character after the equal sign. Otherwise return NULL. 63static const char* env_match(const char* envstr, const char* name) { 64 size_t i = 0; 65 66 while (envstr[i] == name[i] && name[i] != '\0') { 67 ++i; 68 } 69 70 if (name[i] == '\0' && envstr[i] == '=') { 71 return envstr + i + 1; 72 } 73 74 return NULL; 75} 76 77static bool __is_valid_environment_variable(const char* name) { 78 // According to its sources, the kernel uses 32*PAGE_SIZE by default 79 // as the maximum size for an env. variable definition. 80 const int MAX_ENV_LEN = 32*4096; 81 82 if (name == NULL) { 83 return false; 84 } 85 86 // Parse the string, looking for the first '=' there, and its size. 87 int pos = 0; 88 int first_equal_pos = -1; 89 while (pos < MAX_ENV_LEN) { 90 if (name[pos] == '\0') { 91 break; 92 } 93 if (name[pos] == '=' && first_equal_pos < 0) { 94 first_equal_pos = pos; 95 } 96 pos++; 97 } 98 99 // Check that it's smaller than MAX_ENV_LEN (to detect non-zero terminated strings). 100 if (pos >= MAX_ENV_LEN) { 101 return false; 102 } 103 104 // Check that it contains at least one equal sign that is not the first character 105 if (first_equal_pos < 1) { 106 return false; 107 } 108 109 return true; 110} 111 112static bool __is_unsafe_environment_variable(const char* name) { 113 // None of these should be allowed in setuid programs. 114 static const char* const UNSAFE_VARIABLE_NAMES[] = { 115 "GCONV_PATH", 116 "GETCONF_DIR", 117 "HOSTALIASES", 118 "LD_AOUT_LIBRARY_PATH", 119 "LD_AOUT_PRELOAD", 120 "LD_AUDIT", 121 "LD_DEBUG", 122 "LD_DEBUG_OUTPUT", 123 "LD_DYNAMIC_WEAK", 124 "LD_LIBRARY_PATH", 125 "LD_ORIGIN_PATH", 126 "LD_PRELOAD", 127 "LD_PROFILE", 128 "LD_SHOW_AUXV", 129 "LD_USE_LOAD_BIAS", 130 "LOCALDOMAIN", 131 "LOCPATH", 132 "MALLOC_CHECK_", 133 "MALLOC_TRACE", 134 "NIS_PATH", 135 "NLSPATH", 136 "RESOLV_HOST_CONF", 137 "RES_OPTIONS", 138 "TMPDIR", 139 "TZDIR", 140 NULL 141 }; 142 for (size_t i = 0; UNSAFE_VARIABLE_NAMES[i] != NULL; ++i) { 143 if (env_match(name, UNSAFE_VARIABLE_NAMES[i]) != NULL) { 144 return true; 145 } 146 } 147 return false; 148} 149 150static void __sanitize_environment_variables() { 151 char** src = _envp; 152 char** dst = _envp; 153 for (; src[0] != NULL; ++src) { 154 if (!__is_valid_environment_variable(src[0])) { 155 continue; 156 } 157 // Remove various unsafe environment variables if we're loading a setuid program. 158 if (get_AT_SECURE() && __is_unsafe_environment_variable(src[0])) { 159 continue; 160 } 161 dst[0] = src[0]; 162 ++dst; 163 } 164 dst[0] = NULL; 165} 166 167unsigned* linker_env_init(unsigned* environment_and_aux_vectors) { 168 // Store environment pointer - can't be NULL. 169 _envp = reinterpret_cast<char**>(environment_and_aux_vectors); 170 171 // Skip over all environment variable definitions. 172 // The end of the environment block is marked by two NULL pointers. 173 unsigned* aux_vectors = environment_and_aux_vectors; 174 while (aux_vectors[0] != 0) { 175 ++aux_vectors; 176 } 177 ++aux_vectors; 178 179 __init_AT_SECURE(aux_vectors); 180 __sanitize_environment_variables(); 181 182 return aux_vectors; 183} 184 185const char* linker_env_get(const char* name) { 186 if (name == NULL || name[0] == '\0') { 187 return NULL; 188 } 189 190 for (char** p = _envp; p[0] != NULL; ++p) { 191 const char* val = env_match(p[0], name); 192 if (val != NULL) { 193 if (val[0] == '\0') { 194 return NULL; // Return NULL for empty strings. 195 } 196 return val; 197 } 198 } 199 return NULL; 200} 201